Citrix Patches Exploited NetScaler Zero-Day Causing Denial of Service
Summary
Citrix patched CVE-2026-88779, a zero-day memory overflow affecting SAML-configured, customer-managed NetScaler appliances. Exploitation causes denial of service; administrators should upgrade to fixed builds and investigate unexplained instability.
Key points
- The remotely reachable flaw affects specified NetScaler ADC and Gateway versions configured as SAML service providers or identity providers; it requires no privileges or user interaction.
- Citrix confirmed targeted exploitation before patches were available. The supported impact is denial of service; reliable remote code execution, authentication bypass, and data theft have not been established.
- Fixed builds include 14.1-73.41 or later, 13.1-64.28 or later, and 13.1-37.282 or later for the listed FIPS/NDcPP branch.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 4, 2026, with an October 7 remediation deadline for covered federal agencies.
- Citrix urges customers to upgrade affected appliances promptly and verify whether the required SAML configurations are present.
- Investigate unexplained crashes, reboot loops, SAML failures, Gateway or AAA instability, suspicious authentication inputs, and unexpected outbound activity.
Article Details
- Vulnerability Types
- Memory overflow
- Severity
- High (CVSS v4.0 score 8.7); confirmed impact is denial of service.
- Affected Versions
- NetScaler ADC / Gateway 14.1 before 14.1-73.41
- NetScaler ADC / Gateway 13.1 before 13.1-64.28
- NetScaler ADC 14.1-FIPS before 14.1-73.41 FIPS
- NetScaler ADC 13.1-FIPS / NDcPP before 13.1-37.282
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- available
CVE
Vendors
Products
NetScaler ADCThe memory overflow affects customer-managed NetScaler ADC and NetScaler Gateway appliances using SAML authentication and can cause Denial of Service (DoS) conditions.NetScaler ConsoleNetScaler Console can identify affected systems under CVE Detection → Impacted Instances and launch the upgrade process.NetScaler GatewayThe memory overflow affects customer-managed NetScaler ADC and NetScaler Gateway appliances using SAML authentication and can cause Denial of Service (DoS) conditions.Secure Private Access HybridSecure Private Access Hybrid deployments using customer-managed NetScaler instances are also affected.